Top all-time · #60
Project Zero
Company blog · googleprojectzero.blogspot.comsecurityprogramming
Project Zero is the company blog at googleprojectzero.blogspot.com, writing about security and programming. Since 2014, 527 different Hacker News readers have linked it 851 times, most often “A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution”. It is still writing: the last post was on 2026-10-27, and you can follow it by feed.
Make zeroday hard
Most-linked posts?
- A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution51 people · 57 mentions · first linked 2021-12-15
- Reading privileged memory with a side-channel28 people · 29 mentions · first linked 2018-01-03
- A walk through Project Zero metrics20 people · 20 mentions · first linked 2019-05-30
- A deep dive into iOS Exploit chains found in the wild19 people · 27 mentions · first linked 2019-08-30
- A Look at iMessage in iOS 1417 people · 18 mentions · first linked 2021-01-28
- Android RCE via Phone Number13 people · 13 mentions · first linked 2023-03-16
- Examining Pointer Authentication on the iPhone XS10 people · 11 mentions · first linked 2019-02-01
- /2021/12/a-deep-dive-into-nso-zero-click.html?m=110 people · 10 mentions · first linked 2022-01-30
- Fuzzing ImageIO9 people · 9 mentions · first linked 2020-04-28
- An iOS zero-click radio proximity exploit odyssey9 people · 9 mentions · first linked 2020-12-01
What Hacker News says?
That's unclear, to the point of being factually wrong. Variant 2 and Variant 3 POCs only affect Intel, and those are the ones people are most talking about, and at least to me, the most concerning. Treating them as a group, ignores the very real differences in effect. https://googleprojectzero.blogspot.com/2018/01/reading-privi...
Comment linking /2018/01/reading-privileged-memory-with-side.html
on “Reading privileged memory with a side-channel”Submitted Reading privileged memory with a side-channel as a story · 2334 points
HN discussionHere's a list of what google tested: Intel(R) Xeon(R) CPU E5-1650 v3 @ 3.50GHz (called "Intel Haswell Xeon CPU" in the rest of this document) AMD FX(tm)-8320 Eight-Core Processor (called "AMD FX CPU" in the rest of this document) AMD PRO A8-9600 R7, 10 COMPUTE CORES 4C+6G (called "AMD PRO CPU" in the rest of this document) An ARM Cortex A57 core of a Google Nexus 5x phone [6] (called "ARM Cortex A57" in the rest of…
Comment linking /2018/01/reading-privileged-memory-with-side.html
on “Reading privileged memory with a side-channel”Submitted A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution as a story · 1005 points
HN discussionMore details at https://googleprojectzero.blogspot.com/2018/01/reading-privi...
Comment linking /2018/01/reading-privileged-memory-with-side.html
on “Reading privileged memory with a side-channel”Submitted This shouldn't have happened: A vulnerability postmortem as a story · 938 points
HN discussionlink for details for that from Project Zero: https://googleprojectzero.blogspot.com/2018/01/reading-privi...
Comment linking /2018/01/reading-privileged-memory-with-side.html
on “Reading privileged memory with a side-channel”Submitted A deep dive into iOS Exploit chains found in the wild as a story · 804 points
HN discussionYou can find the details below. They've tried AMD CPUs also. https://googleprojectzero.blogspot.com/2018/01/reading-privi...
Comment linking /2018/01/reading-privileged-memory-with-side.html
on “Reading privileged memory with a side-channel”Submitted An iOS zero-click radio proximity exploit odyssey as a story · 647 points
HN discussionThis kind of crap is why we need to be cautious in allowing Google too much control over web standards, including AMP and their not-iframe element (portals [1]). Whilst the engineers mean well when creating them, Google's main objective is to make money, not to make a better web. At the moment you have awesome projects like Project Zero [2], but how long till they start strategically handling exploits for monetary g…
Comment linking /
on “Google to restrict modern ad blocking Chrome extensions to enterprise users”Submitted How to Compromise the Enterprise Endpoint as a story · 553 points
HN discussionFrom the article... 15/09/24 - Report sent to vendor ... 29/01/25 - Vendor requests extension for disclosure to 12/02/2025 09/02/25 - Confirm to vendor that both parts of the exploit have been fixed (T+147 days since disclosure) 12/02/25 - Report disclosed So that is 136 days not fixed(?) and Google asks for extension. Then 147 days to fix and 150 days to public disclosure. Compare this to Google Project Zero which…
Comment linking /p/vulnerability-disclosure-faq.html
on “Leaking the email of any YouTube user for $10k”Submitted A Look at iMessage in iOS 14 as a story · 528 points
HN discussion#0016 VENDOR: GOOGLE STATUS: FIXED (NOVEMBER 2022 UPDATE) REPORTED: JUN 13, 2022 DISCLOSED: NOV 10, 2022 (150 DAYS) Project Zero only gives vendors 7 or 90 days before disclosure... The short version: Project Zero won't share technical details of a vulnerability for 30 days if a vendor patches it before the 90-day or 7-day deadline. The 30-day period is intended for user patch adoption. https://googleprojectzero.blo…
Comment linking /2021/04/policy-and-disclosure-2021-edition.html
on “Accidental Google Pixel Lock Screen Bypass”Submitted Over the Air: Exploiting Broadcom’s Wi-Fi Stack as a story · 439 points
HN discussion[Disclaimer: I worked in Apple Red Team] What if this isn’t a good news for 99% of Apple users? That’s obviously an amazing measure for the 1% high targets out there. But what about the other 99%? Does that create an incentive for Apple to strengthen Lockdown Mode security to the detriment of the regular mode (should we call it Unsafe Mode)? I’m afraid that this architecture will make it harder to prioritize securit…
Comment linking /2021/01/a-look-at-imessage-in-ios-14.html
on “Apple previews Lockdown Mode”Submitted Down the Rabbit-Hole as a story · 430 points
HN discussionHence my "parts of Google" comment - for an organization as large as Google, I don't think that saying that it "desires" anything other than profit is particularly meaningful. There are people and teams at Google who agree that this is a problem. I have no idea what influence they have over the people/teams that make the Pixel, or vice versa. For a good example of this, see the conclusion of this recent Project Zero…
Comment linking /2019/11/bad-binder-android-in-wild-exploit.html
on “Nebraska farmers vote overwhelmingly for Right to Repair”Submitted The State of State Machines as a story · 426 points
HN discussionModified clients are definitely possible - review the recent Project Zero research into webRTC vulnerabilities, which included a look at FaceTime and discovered several exploitable bugs https://googleprojectzero.blogspot.com/2018/12/adventures-in...
Comment linking /2018/12/adventures-in-video-conferencing-part-2.html
on “FaceTime bug lets you hear audio of person you are calling before they pick up”Submitted The Fully Remote Attack Surface of the iPhone as a story · 425 points
HN discussionhttps://googleprojectzero.blogspot.com/2019/08/a-very-deep-d... 5 zero-click compromises. Thousands per week for a total of 2 years before discovery. The 5 chains being: 3 months, 6 months, 10 months, 6 months, 3 months each. At thousands per week, that is 12k, 24k, 40k, 24k, 12k new compromises per chain at a minimum, probably closer to 5x those numbers. Incidentally, at the bottom of the initial post they mention:…
Comment linking /2019/08/a-very-deep-dive-into-ios-exploit.html
on “New Google SRE book: Building Secure and Reliable Systems”Submitted Exploiting the Wi-Fi Stack on Apple Devices as a story · 347 points
HN discussionThe "code execution" in PDF parsing is what enabled this legendary zero-click, zero-day exploit of iOS devices: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
Comment linking /2021/12/a-deep-dive-into-nso-zero-click.html
on “Show HN: Tetris in a PDF”Submitted How to unc0ver a 0-day in 4 hours or less as a story · 346 points
HN discussion>Do you actually work in security research? Yep! >You're confusing finding accidental bugs with an actor trying to hide behavior. The latter you will not find if the actor is as big as a FAANG or nation state. Wrong, wrong, wrong. Here's but one of many examples: https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d... >it shows that a code audit will not turn up malicious behavior if the owner is actively tr…
Comment linking /2019/08/a-very-deep-dive-into-ios-exploit.html
on “Facebook executives shut down efforts to make the site less divisive”Submitted Project Zero: Exploiting the DRAM rowhammer bug to gain kernel privileges as a story · 339 points
HN discussion> Even if you are willing to expend that cognitive overhead, most people aren’t nowadays. Shouldn't this cancel out against there being more people though? If people are 90% less likely to want to read long blog posts but there are ten times more people on the internet, you should still have about the same number of readers, all else equal. > Because of that, bloggers are less likely to publish (smaller audience + l…
Comment linking /
on “If I could bring one thing back to the internet it would be blogs”Submitted A cache invalidation bug in Linux memory management as a story · 312 points
HN discussion
